If you need to remove malware from a Windows computer,
one way to go about doing that is through the Windows Recovery
Environment.
This is a command line that you can launch on your Windows
computer that is used without having to start
the entire operating system.
This effectively gives you access
to all of the files that are in your operating system.
So it is a very dangerous way of changing things
that are inside of your operating system,
and it should be considered a method of last resort
when it comes to removing malware.
But with that warning in place, this Windows Recovery
Environment gives you a lot of access to the operating system,
and you can effectively make any change you would like
to any of the files in the OS.
But of course, because this is simply giving you
a command line prompt, you now have
to be knowledgeable enough to know what to do at this prompt
to be able to remove the malware.
From here, you can copy or modify
files that are part of your operating system.
You can enable or disable services
from starting during startup.
Or you can modify the file system, run some diagnostics,
or modify any part of the underlying file system.
One of the ways to start this recovery environment
is from inside of Windows itself.
When you click on the power icon,
get the options for sleep shutdown and restart,
you would click restart but you would hold down the Shift
key while clicking that option.
You could also find the installation media
for your version of Windows and boot
from that media when your system starts.
You can also tell Windows to restart, but restart
in the advanced startup mode.
In Windows 10, you'd find this under Settings, Update
and Security, Recovery, and Advanced startup.
In Windows 11, it's under System, Recovery, Advanced
startup, and Restart Now.
When Windows restarts, you'll see this screen up here
that says choose an option.
You can continue to start your Windows version,
you can turn off your PC, you can use the device,
or you can choose the option that we'd like to troubleshoot.
When you click that option, you'll
get another screen that has an option to reset this PC.
If you'd like to choose the option for advanced options
and underneath all of those advanced options,
you want to choose command prompt.
When you select that option, the command prompt
will appear on the screen and you now
have complete access to the operating system.
You can sometimes catch this malware
before it executes on your system
by simply running some antivirus or anti-malware software.
You would need software that can stop both viruses and malware,
and it's very common that when you install
this type of security software these days,
it's automatically protecting against both.
Some anti-malware software only works when you
tell it to scan your system.
Obviously, that's not going to prevent
malware that may have already been
installed onto your computer.
Instead, you want to be sure that you're running a real time
version of this software so that it's always activated.
And if you happen to accidentally download
some malware, it can immediately prevent it
from executing on your system.
And there's even a new style of anti-malware software
that looks for malicious activity on your system
instead of relying on a set of signatures.
This is an even more advanced form of anti-malware
because it can look at the symptoms and results
of anti-malware and prevent any of those malicious acts
from occurring, regardless of the software
that might be running.
We also want to prevent anyone from outside of our system
from gaining access to our operating
system across the network.
One way to do this is to run a software firewall
on your operating system so that it sits on your local computer
and monitors all of the inbound and outbound traffic
from your PC.
This might stop malware that's been recently installed
from communicating outbound from your system,
and it would certainly prevent any type of malware
from coming inbound to your computer.
If you've installed Windows you're
already using software firewall in the form of Microsoft's
Defender Firewall and this is what you'd
like to use at a bare minimum.
This software runs by default it is constantly
monitoring the network communication,
and it can allow or block based on a number
of different criteria.
But even with all of the necessary security
software in place, you still have
vulnerabilities on your network in the form of the users.
Your users may click information on the screen
that they weren't intending to click
or they may be providing information to a third party
without realizing that they're providing private details.
An attacker will use a number of different techniques to fish
or gain private information from users.
So it's useful to be able to have training that
can have them recognize when these types of situations
may be occurring.
Many companies will train their users
and then send out phishing emails that
were created by the company themselves just
to see who might click on these emails
and then provide information.
And if a user does provide private information
or their login credentials during this internal test,
we can mark that user for additional training.
This training might be one on one training
where you're giving someone personalized information
about how they can prevent these types of vulnerabilities.
You might put posters and signs up in your work area
to remind people about what they should
be looking for during these phishing attempts.
If you have an internal message board,
you might want to post messages that
can remind people about their requirements for security.
And you might provide messages during login or updates
on the intranet that make everyone
aware of what they should be doing to prevent
any of these phishing attacks.
Ultimately, there's only one way to guarantee
that you've removed malware from a system, that's
to delete everything on the system
and install a fresh version of the operating system
or install from a known good backup.
It's that known good part that is the important part
of the backup.
You don't want to restore a version of the operating
system that may have already been infected with malware.
So make sure that your backup is one
that is not already infected.
You could also, of course, perform a manual installation
of the operating system and go through all
of the prompts that are necessary to be
able to install that OS.
That's obviously a much slower form of installation,
but ultimately, it does provide you
with a fresh version of the operating system.
And many organizations have operating system images
that have already been created.
So you can delete everything on that computer
and re-image with a known safe version of the operating system
very quickly.